Skip to content
Threat Feed
Subscribe

Vendor

Winter CMS

2 briefs RSS
low advisory

Stored XSS in Winter CMS and October CMS Backend

Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.

Winter CMS +2
1t 2c
high advisory

Improper Input Validation in Winter CMS Backend Postback

Authenticated backend users can exploit an input validation vulnerability in the Winter CMS form postback mechanism to execute restricted controller methods, leading to unauthorized administrative actions.

wn-backend-module web-application privilege-escalation cms
1t